Consumers Unwilling to Let Unsupervised AI Agents Shop, Identity Gaps Surface in Okta Report
What Happened — Okta’s 2026 Customer Identity Trends Report surveyed North American consumers and found that only 37 % are comfortable allowing an AI agent to make final purchasing decisions without human oversight. Willingness rises above 50 % when users can approve or reverse the agent’s actions. The study also revealed that 52 % of consumers think AI capabilities are advancing too quickly, and many businesses struggle to support AI‑agent access because their identity‑infrastructure is under‑engineered. When identity systems fall short, engineering teams resort to ad‑hoc work‑arounds that can expose sensitive customer data.
Why It Matters for Trust & Control Assurance — The gap highlights the control objective of managing AI‑agent identities and permissions, a core access‑control assurance requirement that maps to the NIST AI RMF.
Who Is Affected — Retail/e‑commerce platforms, SaaS providers, and any organization exposing AI‑driven assistants to consumers.
Recommended Actions
- Define distinct, least‑privilege identities for each AI agent.
- Enforce time‑bound credentials and require explicit user approval for high‑risk actions (e.g., payment, address change).
- Log and audit AI‑agent activity to provide defensible evidence for auditors and regulators.
Technical Notes
- Consumer reluctance is driven by perceived lack of control and the speed of AI feature rollout.
- Identity‑infrastructure gaps lead to makeshift integrations that bypass standard access controls, increasing the risk of data leakage.